How to build crypto transaction monitoring
Crypto transaction monitoring is how exchanges, banks, stablecoin issuers and payment companies check the onchain transfers, wallets and trades they’re responsible for against their lists and rules, so their compliance teams can review each flag and decide what to do.
This playbook sets out the decisions in the order you’ll make them. Each one links to the use case pages and docs that cover it in detail.
Choose whose transfers you check, and for what
Decide whose transfers you check, your customers’ or every holder of a token you issue, and whether your tool screens against lists, scores risk, or both.
- Use caseCrypto wallet screening and sanctions dataFlag transfers that touch sanctioned or high-risk addresses.
- Use caseData for crypto AML transaction monitoringFeed complete transfer data to AML tools with lineage from the chain to the case.
- Use caseSecondary-market sanctions sweeps for token issuersScreen every holder and transfer of your stablecoin, not only your direct customers.
- Use caseCrypto scam and money mule detection dataFlag payments to scam-linked wallets and customer accounts that act as money mules.
Watch your own wallets and contracts
List the wallets and contracts you run, and the events that should reach someone at once, such as a large outflow, a dormant wallet moving or an admin setting changed.
- Use caseCrypto wallet monitoringGet an alert when a watched wallet makes a large transfer, crosses a balance limit, wakes after dormancy or pays an unknown counterparty.
- Use caseSmart contract and wallet monitoringWatch your contracts and wallets for attacks and unexpected changes.
- Use caseMonitor crypto withdrawals from your hot walletsWatch every transfer leaving an exchange’s hot wallets, tie it to a customer’s withdrawal request and flag outflows nobody requested.
Surveil trading in tokenized securities
If you list or issue tokenized securities, decide whether to watch for wash trades, best execution and new tokens that copy your security’s name.
- Use caseCrypto market surveillance for tokenized securitiesWatch trading in tokenized securities for manipulation and other market abuse.
- Use caseBest execution monitoring for tokenized securitiesCompare each onchain fill in a tokenized security with the market price at that moment, flag fills that missed it, and keep the record your execution-quality reviews run on.
- Use caseUnauthorized tokenization monitoringFind tokens that claim to represent your security without your consent.
- GuideSecurities compliance & market surveillanceStream identity and freeze events for tokenized securities, and send trades with the same owner on both sides to your surveillance tool.
Stream every transfer or call a transfers API
Stream every transfer when your tool checks activity as it happens, and call a transfers API when you check one wallet at onboarding or in a case review.
- Use caseWays to screen crypto wallets against sanctions listsEach way to build it side by side, with what each one suits best.
- Use caseWays to get transfer data to your AML monitoring toolEach way to build it side by side, with what each one suits best.
- DocsFeeds API: TransfersGet the native and token transfers in and out of one wallet across chains, newest first, with the USD value at transfer time.
Keep your lists where screening can read them
Load your sanctions data provider’s list and your own blocklist into a table the screening checks, so a newly listed address is screened without redeploying anything.
- DocsTurbo Pipelines dynamic tablesUpdate a lookup table in Postgres, such as a list of watched addresses, while the pipeline runs, and filter transfers against it.
- GuideStablecoin compliance & AML monitoringScreen stablecoin transfers against a watchlist you can update while the pipeline runs, and record the decision on each hit with a Compose task.
Load past transfers before streaming new ones
Decide how far back your tool needs each wallet’s transfers, and load that history once before new transfers stream in.
- Use caseSupply crypto AML transaction monitoring by streaming every transferA pipeline Goldsky runs loads past transfers once, then streams every new one to a queue and to your warehouse at the same time.
- DocsTurbo job mode: one-time backfills and batch pipelinesRun a Turbo pipeline once over a bounded block range and let it exit, for backfills and data migrations.
Expect repeated and corrected deliveries
A transfer can be delivered twice, or undone when the chain replaces its newest blocks (a reorg), so your tool should skip repeats and apply corrections.
Hold a transfer until the other wallet is checked
Decide which transfers wait for a verdict on the other wallet before they’re signed, paid out or accepted, and what happens to the money while they wait.
- Use casePre-signing policy checks for custodiansCheck a transaction against policy and risk verdicts before the custodian signs it, and block the signature if it fails.
- Use caseScreen the recipient wallet before a payoutCheck a recipient wallet before a payout is sent to it.
- Use caseScreen the payer before accepting a stablecoin paymentHold a stablecoin payment in escrow until the payer’s wallet is screened, then release it to the business or refund the payer, with every decision recorded.
- GuideBuild a compliance oracleHold a USDC payment in escrow while a Compose task screens the sender’s wallet, then release or refund it and keep a record of each decision.
Check a client’s or counterparty’s wallets before onboarding
Gather the full history of the wallets a client or counterparty declares, so your providers and compliance team can judge where the funds came from before you take them on.
- Use caseVASP and counterparty due diligence dataProfile a VASP, issuer or counterparty by its onchain exposure before onboarding it and while the relationship lasts.
- Use caseCrypto source of funds and wealth checksTrace where a client’s onchain funds came from to document legitimate wealth at onboarding.
- Use caseWays to gather wallet history for a source of funds checkEach way to build it side by side, with what each one suits best.
Review a token before you list it
Settle what your listing committee needs from the chain, such as holders, supply and links to risky wallets, and how often to check a token again once it trades.
Warn users about risky token approvals
Choose whether your app lists each user’s open token approvals (permissions for a contract to move their tokens) and prompts them to revoke the risky ones.
Send each flag to the people who review it
Pick where flags land, such as a queue, a case tool or an alerting system, and who reviews them, since clearing, escalating and reporting stay with your team.
- Use caseScreen crypto wallets against sanctions lists by streaming every transferA pipeline Goldsky runs reads every transfer of the tokens you watch, checks the sender and the recipient against your list, and sends each hit to your message queue or case tool.
- Use caseMonitor crypto wallets with a live watch listA pipeline checks every transfer on the chains you choose against your list of watched wallets, sends the ones that break a rule to your alerting system as they happen, and keeps a running balance for each wallet in your database.
- DocsTurbo webhook sinkPost pipeline rows to your endpoint as JSON, with retries and at-least-once delivery, so your endpoint has to ignore repeats.
Freeze a wallet or pause a contract
Agree who can freeze a wallet or pause a contract after a flag, and whether any rule pauses a contract without waiting for a person.
- Use caseMonitor your smart contracts and wallets with a streaming pipelineA pipeline Goldsky runs decodes every event on the contracts and wallets you list, applies your rule to each one, and sends a match to your alerting tool and to a Compose task that can call your contract’s pause function.
- Use caseStablecoin freezes and seizuresRecord every freeze, seizure and burn on a lawful order, with the balance it affected.
- Use caseOnchain circuit breakersPause a token, market or payout when a rule is breached.
Give investigators the full chain history
Decide whether investigators query a chain’s full history in your warehouse or read transaction traces case by case.
- Use caseWays to get chain history and traces for forensicsEach way to build it side by side, with what each one suits best.
- Use caseRaw chain history and traces for risk vendorsGive a risk or forensics product the full history, traces and archive reads of every chain it covers.
- DocsEdge RPC: trace_transactionGet the full trace of a mined transaction by its hash, including the calls it made inside contracts.
Keep a record examiners can follow
Keep every flag, verdict and action with the transfer it came from, because examiners can test what you report against the chain.
- Use caseData for crypto AML transaction monitoringFeed complete transfer data to AML tools with lineage from the chain to the case.
- Use caseOnchain supervisory monitoring for regulatorsGive examiners one view of licensed firms’ onchain activity to test against what the firms report.
- Use caseStablecoin admin action logRecord every mint, burn, freeze, clawback and role change with its time and signer for risk and audit review.
Turn this plan into a working build
We can help you work through each decision and get the first stage into production.
Robinhood
HyperEVM
Arc
Solana
Ethereum
Polymarket
Base
Tempo
Bitcoin